Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects the CornFlake RAT masquerading as 'svchost32.exe' executing from within user AppData directories. The rule correlates the initiation of audio/video capture APIs (WASAPI or MediaFoundation) by this process with the subsequent creation of .wav, .jpg, or .jpeg files, suggesting unauthorized audio or camera capture by the malicious process.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects a suspicious pattern where a process creates a file in /dev/shm/, unlinks it, and re-executes itself from /proc/self/fd/ while manipulating the process name to masquerade as the systemd-journald daemon. This behavior is indicative of fileless execution techniques used by malware to maintain a presence while blending in with legitimate system processes.
Detects the creation of a Windows service using 'sc.exe' with names or command-line indicators associated with legitimate Windows update services, a technique commonly used by the TOKYOCORE malware for persistence.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects the presence of BridgeHead tunneler binaries disguised as legitimate library files ('unbcl.dll' or 'libwinpthread-1.dll') within non-standard directories, a behavior associated with Mirage Kitten intrusions.
Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
It is highly recommended to perform an initial baseline before using this rule in production.
Detects the creation or modification of Windows Registry Run keys that masquerade as the legitimate 'WindowsUpdate' process. The rule identifies suspicious autorun entries, such as 'fsociety.exe' or specific file hashes, being registered under common Run or RunOnce keys to maintain persistence.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects endpoint file artifacts associated with known malicious browser extension IDs in browser extension storage paths, indicating possible installation or presence of malicious browser extensions.
Detects creation of PHP web shell files or plugin directories under WordPress wp-content/plugins using the wp2shell_<hex> naming convention, associated with the wp2shell WordPress Core RCE exploitation chain.
Detects creation of PHP web shell files or plugin directories under WordPress wp-content/plugins using the wp2shell_<hex> naming convention, associated with the wp2shell WordPress Core RCE exploitation chain.
Detects the dropping of the NoEscape ransomware DISKWRITER binary, masquerading as 'winnt32.exe' within the C:\Windows\SysWOW64\ directory. This is identified by the specific file path and hash associated with the known malware threat.
Detects creation of PHP web shell files or plugin directories under WordPress wp-content/plugins using the wp2shell_<hex> naming convention, associated with the wp2shell WordPress Core RCE exploitation chain.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects high-confidence BoryptGrab-lineage infostealer activity involving fake GitHub delivery indicators, known C2 infrastructure, suspicious gup.exe execution, libcurl.dll side-loading from user-writable paths, and known malicious file hashes.
Detects process creation events where a process reported as TiWorker.exe (a trusted Windows servicing process) carries a command line containing Invoke-Mimikatz or Mimikatz command modules, indicating the process identity has been spoofed via a Silo-Binding bind-link mapping TiWorker.exe to PowerShell to evade AV/EDR script-blocking controls.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Page 13 of 33